4343eb0044937539f285310dbe959bcd[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

4343eb0044937539f285310dbe959bcd.bin
Size

221KB
MD5

ba6b1a63a9d911da96350a03bc59ed29
SHA1

779f0f7ecb78ed0d3f64602cd831f4b85980edc6
SHA256

bda68f3beb9df0509ab3fe41a5d036bec3a527cd0d91bf1ebde3eef987656d43
SHA512

a163ecf3f9d04f4ade207d1ea6b34b7d5facf4530f51416101d522ed4040d9f6fad3dcefc1a4546341c9bc5875dda765c95fb734da8034097861fcd284dbd0eb
SSDEEP

3072:n2vKXvTg+aYW38IX5SZRMtpHBk0QF1EU+PGJQewWE9SMHUhDVenKe6Xjx4rxfDq+:n2OJaNXAYpHBkXaYTwRuUKe/lp3X3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ee8dfab47a4dfa70826a72ca05c2c45872cc317c94e91c48e73cf2ef361718ed.exe

Files

4343eb0044937539f285310dbe959bcd.bin
.zip

Password: infected
ee8dfab47a4dfa70826a72ca05c2c45872cc317c94e91c48e73cf2ef361718ed.exe
.exe windows x64

Password: infected

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

kernel32

GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
OutputDebugStringA
CreateMutexW
lstrlenA
MultiByteToWideChar
ReleaseMutex
GetVersionExW
GetSystemDefaultUILanguage
Sleep
CloseHandle
WriteFile
lstrlenW
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RegisterApplicationRestart
HeapSetInformation
DeleteFileW
GetTempPathW
FreeLibrary
WideCharToMultiByte
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
RaiseException
GlobalDeleteAtom
GlobalAddAtomW
GetLastError
GetCurrentThreadId
SetLastError

gdi32

CreateCompatibleBitmap
CreatePen
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
GetStockObject
Rectangle
SelectObject
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetLayout
GetClipRgn
SelectClipRgn
GetObjectW
CreatePolygonRgn
OffsetRgn
FillRgn
PatBlt
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
SetLayout
CreateSolidBrush

user32

MapWindowPoints
GetMonitorInfoW
CopyRect
UnregisterClassA
DeferWindowPos
BeginDeferWindowPos
SetCursor
GetIconInfo
GetWindowTextW
CallWindowProcW
DrawIconEx
OffsetRect
GetWindowRgnBox
UnregisterHotKey
GetWindowLongW
GetForegroundWindow
DestroyMenu
CheckMenuRadioItem
GetSystemMetrics
IsWindowVisible
ShowWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetWindowLongPtrW
SetWindowLongPtrW
BeginPaint
LoadMenuW
SetCapture
ReleaseCapture
UnionRect
InvalidateRect
GetPropW
SetPropW
IntersectRect
EnumDisplayMonitors
IsIconic
PtInRect
GetWindow
LogicalToPhysicalPoint
SetRect
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetClassNameW
GetParent
LoadAcceleratorsW
GetWindowRect
TranslateAcceleratorW
LoadStringW
CreateWindowExW
AdjustWindowRect
RegisterHotKey
DestroyWindow
MonitorFromWindow
EndDeferWindowPos
LoadIconW
GetSubMenu
LoadImageW
SetClassLongPtrW
SetWindowTextW
IsZoomed
DialogBoxParamW
CheckDlgButton
IsDlgButtonChecked
GetClientRect
DrawFocusRect
DrawTextW
GetProcessDefaultLayout
TrackPopupMenuEx
SetScrollInfo
GetScrollInfo
SetFocus
DefWindowProcW
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
EndPaint
AdjustWindowRectEx
InflateRect
FillRect
SendMessageW
EndDialog
GetDlgItem
GetDC
SetForegroundWindow
OpenIcon
FindWindowW
MessageBoxW
GetSysColor
SetWindowPos
GetWindowDC
GetDesktopWindow
PostQuitMessage
SystemParametersInfoW

msvcrt

__CxxFrameHandler3
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
free
_vsnwprintf
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
_wcsicmp
memcpy_s
wcscspn
wcsspn
memmove_s
malloc
_resetstkoflw
strstr
_vscwprintf
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
memset
__C_specific_handler
vswprintf_s
_CxxThrowException

ntdll

WinSqmIncrementDWORD
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
WinSqmIsOptedIn

gdiplus

GdipSaveImageToStream
GdipMeasureString
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipCreateFontFromLogfontW
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawString
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipFillEllipseI
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipGetImageEncoders

comctl32

ImageList_Create
ImageList_Add
ord380
ImageList_Destroy
ord345
InitCommonControlsEx

shlwapi

UrlCreateFromPathW
PathFindExtensionW
StrStrA
PathIsURLW
StrChrW
ord487
PathFindFileNameW
ord158
SHRegGetUSValueW
PathRemoveExtensionW

shell32

ShellAboutW
ord75
SHCreateItemInKnownFolder

ole32

CoTaskMemFree
StringFromCLSID
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoUninitialize

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
VarBstrCat
SysAllocStringLen
SysStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString
SafeArrayPutElement

uxtheme

GetThemeSysFont
GetThemeSysColor

oleacc

AccessibleObjectFromWindow

slc

SLGetWindowsInformationDWORD

msdrm

DRMIsWindowProtected

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d1884757532ce7b0014241f40262c929

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

uxtheme

oleacc

slc

msdrm

Sections

.text Size: 165KB - Virtual size: 165KB

.data Size: 1024B - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 246KB - Virtual size: 246KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.data
Size: 1024B - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 246KB - Virtual size: 246KB

.reloc
Size: 1KB - Virtual size: 1KB